Google Chrome EUVD-2026-100646

Exploitation requires the victim to load attacker-controlled HTML into a vulnerable Chrome build (any version prior to 155.0.8059.79) that exercises the Animation component; this is the UI:R / UI:P 'crafted HTML page' requirement - the user must navigate to or render the malicious page (e.g., via a link, ad frame, or compromised site). No authentication or special non-default configuration is needed (PR:N), but the mandatory user interaction and the fact that resulting code execution is confined to the renderer sandbox (S:U) are the key limiting factors: full host compromise would require chaining an additional sandbox-escape vulnerability, and users on patched builds (155.0.8059.79 or later) are not affected.

Signals are largely consistent and point to a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U) describes a network-reachable, low-complexity, unauthenticated flaw requiring user interaction, scoring 8.8 (High), and Chromium rates it High severity. However, the impact is explicitly bounded: the description states code execution occurs 'inside the sandbox,' which is why Scope is Unchanged (S:U) rather than Changed - on its own this bug does not escape the renderer sandbox and would need to be chained with a sandbox-escape to achieve full host compromise. CISA SSVC reinforces a measured posture: Exploitation=none (no observed exploitation), Automatable=no (user must be lured to a crafted page), despite Technical Impact=total. There is no CISA KEV listing and no EPSS score or public POC in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Net: a credible, patch-now browser RCE primitive, but the sandbox containment, mandatory user interaction, and absence of any exploitation evidence make it standard high-priority browser patching rather than a drop-everything KEV-class emergency. Missing data to note explicitly: no EPSS probability was provided and POC availability is unknown, so likelihood of real-world exploitation cannot be quantified from the inputs.

An attacker hosts or compromises a web page containing malicious markup that drives Chrome's Animation subsystem into a heap buffer overflow when rendered. A victim running a vulnerable Chrome build (prior to 155.0.8059.79) visits the page and the overflow is leveraged to execute arbitrary code within the renderer sandbox. No public exploit code is identified in the provided data, and successful full-host compromise would additionally require chaining a separate sandbox escape.